<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Dear MidPoint community,<br>
<p> MidPoint was a part of EU-Free and Open Source Software Auditing
(EU-FOSSA2) bug bounty program. This was an unique experience in
many ways. There were many surprises along the way and it was far
from being easy. But we have gone through that and in the end it
was extremely useful. It has made midPoint stronger and more
secure.</p>
<p> The very first surprise was that midPoint was included in the
bug bounty program at all. That was quite unexpected and I would
like to thank all the people that have decided to make midPoint
part of this program. Here it was, an unexpected opportunity to
improve midPoint security. That is not something that we would
turn down. Therefore we have agreed to participate although we had
no idea what to expect. And almost immediately there was another
surprise: from the very beginning the program was conducted in a
very professional way. We were briefed about the program before
any work started. There was a restricted lead-in period to get
used to the program. And even though this was our first bug bounty
program and it took some time for us to get used to it, the <a
href="https://www.hackerone.com/">HackerOne</a> staff was always
supportive and willing to help, tolerating all the confusion that
we might have caused.</p>
<p> I have to admit that at first I was quite skeptic about the
results of the program. MidPoint is a substantial and complex
piece of software and it takes a lot of time to understand the
mechanisms. I thought that hackers and triage engineers have a
very slim chances to get used to midPoint in the few months that
were available for the program. But there was another surprise.
They did it. Majority of the reports were good, useful and valid.
Some of those reports came from people that already knew midPoint.
Which was quite expected. But there was a surprising number of
reports that came from first-time midPoint users.</p>
<p> Each of the report went through a triage before the report got
to midPoint development team. The triage team did a great job of
validating the reports. The communication was always respectful
and professional. The quality of the triage certainly exceeded my
expectations. Even though we sometimes got lost in the reports and
states and processes, the HackerOne staff kept patiently and
politely reminding us – even after the official end of the
program.The program took a lot of time and effort to go through,
but at the end it was a very pleasant and useful experience.</p>
<p> There was (and perhaps still is) some controversy regarding the
bug bounty program. The program rewards the hackers that discover
a problem, but it does not reward the developers that fix it. This
is certainly an issues that should be addressed and I would love
to see a program that could reward both the hacker and the
developer. But as such program is not available I happily take
what is offered. I strongly believe that security issues always
have to be fixed – regardless of the circumstances that lead to
their discovery. We offer commercial subscription and support
services for midPoint. But we have always fixed security issues
reported by subscribers and non-subscribers alike. And we will
always do that. Software project that is not able to fix security
issues is as good as dead.</p>
<p> On the other hand, there are always attempts to misuse good will
of open source developers. The important thing is to distinguish a
security issue from improvement or feature request. The boundary
may be quite fuzzy when it comes to a security-related system such
as an IDM system. And in fact we had to refuse a couple of reports
on the grounds that they are feature requests rather than security
bug reports. However, overall the experience of the bug bounty
program was a very good one. A lot of useful work was done and
midPoint is now more secure than ever. And that is the most
important thing that matters for the whole community.</p>
(Reposted from <a moz-do-not-send="true"
href="https://evolveum.com/midpoint-went-through-eu-fossa2-bug-bounty/">Evolveum
blog</a>)<br>
<br>
--
<pre class="moz-signature" cols="72">Radovan Semancik
Software Architect
evolveum.com
</pre>
</body>
</html>